Malware-Laced Android TV Boxes Hijacked Home Internet

Google has disrupted a botnet that secretly used more than 1.3 million Android devices, mostly TV set-top boxes, for criminal activity. The takedown stopped the current control servers, but households with affected boxes may still have malware built into their devices.

What happened

According to The Hacker News, Google traced the X.CPE backdoor to Videostrong Technology, a Chinese manufacturer that made Android devices under its own name and for other brands. Google said it was highly confident the company intentionally included the backdoor and sold access to criminals.

The malware operated as a system app inside the device firmware. It could disable Google Play Protect checks, silently install apps, run commands, capture the screen and examine the home network. Google also observed operators copying account information, device details, app lists and system logs.

Criminal modules turned infected boxes into residential proxies, allowing other people’s internet traffic to appear as if it came from the owner’s home connection. The devices were also used for advertising fraud.

Google used legal action to disable the botnet’s control infrastructure and banned Videostrong and future affiliates from producing certified Android devices. However, The Record reported that the built-in malware can reinstall itself after removal. Google said its server takedown had effectively made the malware harmless for now, but researchers warned that criminals can move to new infrastructure.

Who is affected

Most known infections were on Android TV set-top boxes, including some MECOOL-branded products linked to Videostrong. Researchers also found the backdoor on Android-based telehealth equipment, karaoke machines and digital signs.

TrendAI counted infected devices across 206 models, while Synthient published 182 observed model names. A model appearing on that list does not prove every unit is infected. The sources did not disclose a complete consumer-facing list of affected brands or explain whether individual owners will receive notices.

Researchers estimated that roughly 26,000 to 42,000 infected devices were in the United States. Because the backdoor was installed in firmware before purchase, owners may see no obvious warning.

What to do now

1. Identify unfamiliar Android boxes. Check every streaming box or Android-based media device connected to your router. Record its brand and model, then compare it with Synthient’s published list referenced in The Hacker News report.

2. Disconnect a suspected box. Unplug its power and Ethernet cable, or remove it from Wi-Fi through your router’s connected-device controls. Do not use the box for email, shopping, banking or other accounts while checking it.

3. Factory-reset before disposal or further investigation. Plume recommended a complete reset because attackers may have installed additional backdoors. A reset may remove added malware, but the reports warn that it does not permanently remove X.CPE from the firmware.

4. Replace confirmed or strongly suspected hardware. Researchers said lasting cleanup requires action from the manufacturer, platform protection or replacement. A model-specific patch or removal tool has not been disclosed.

5. Separate smart devices from computers and phones. Put replacement streaming and smart-home equipment on a guest Wi-Fi network when possible. CyberSec24’s guest Wi-Fi setup guide explains how to create that separation.

6. Secure accounts used on the box. Because operators could capture screens, keystrokes and account details, change passwords for accounts accessed through a suspected device. Sign out other sessions and enable two-factor authentication where available.